Phishing Emails Use Project Proposals to Deliver SnakeKeylogger
Summary
ASEC reports phishing emails posing as project proposals that deliver JavaScript malware. The script runs PowerShell to decrypt and load SnakeKeylogger in memory, which steals browser data, system information, and keystrokes and exfiltrates them via SMTP or Telegram.
Key points
- ASEC reports phishing emails that pressure recipients to download a compressed attachment by requesting a project proposal and delivery schedule.
- The archive contains JavaScript malware disguised as a proposal document.
- The JavaScript runs PowerShell, which decrypts SnakeKeylogger and executes it in memory without saving it to disk.
- SnakeKeylogger collects browser data, system information, and keystrokes, then sends stolen data through SMTP or Telegram.
- The article identifies mail[.]Trimnt[.]Com as a mail server used for SnakeKeylogger communications.
- ASEC advises verifying senders, checking links and attachments, and avoiding suspicious pages when entering sensitive information.
Article Details
- Event Type
- Phishing campaign delivering SnakeKeylogger through compressed attachments disguised as project proposals.
- Impact
- On infected systems, SnakeKeylogger steals browser data, system information, and keystrokes, then sends the data externally via SMTP or Telegram. No victim count or broader impact is reported.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | mail[.]trimnt[.]com | Identified as the mail server used for SnakeKeylogger C2. |
keishstanford5@gmail[.]com | Identified as the email recipient for SnakeKeylogger data exfiltration. | |
nova3@mnt[.]com | Identified as the ID used with the SnakeKeylogger C2 mail server. | |
| MD5 | 0cbfcc3573399368a2a9abcfa42af134 | MD5 hash reported for the attachment/malware sample. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes the JavaScript malware and PowerShell script as obfuscated.T1056.001 · KeyloggingSnakeKeylogger collects keystroke data from infected systems.T1059.001 · PowerShellThe JavaScript executes PowerShell commands to decrypt and run SnakeKeylogger.T1059.007 · JavaScriptThe malicious attachment is JavaScript that launches the next stage.T1204.002 · Malicious FileThe infection requires a user to download, decompress, and execute the disguised JavaScript file.T1566.001 · Spearphishing AttachmentPhishing emails disguised as project proposals urge recipients to download a compressed attachment.